# COM-04 Information on Information Security Performance and Management Assessment of the ISMS

- Domain: COM – Compliance
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/com-04/

## Basic criterion

### COM-04.01B

The top management of the cloud service provider is regularly informed about the information security performance within the scope of the ISMS in order to ensure its continued suitability, adequacy and effectiveness. The information is included in the management review of the ISMS. This management review is performed at least once a year.

**Supplementary information:**

The top management is a natural person or group of people who take final decisions for the institution and are accountable for these.

The aspects to be dealt with in the management review of the ISMS are listed in section 9.3 of ISO / IEC 27001.

## Additional criterion

### COM-04.01AC (additional, complementing)

The cloud service provider defines and implements technical and operational metrics that align with the organisation's business objectives, security requirements, and compliance obligations. These metrics are documented and included in the management review of the ISMS to ensure their continued suitability, adequacy, and effectiveness.

### COM-04.02AC (additional, complementing)

The responsible business units of the cloud service provider report at least annually to the top management on the the status and effectiveness of the policies and procedures that are relevant to the top management review of the information security management system. This reporting includes at least:

1. Implemented changes to address cybersecurity risks for the topic addressed in the policy or procedure;
2. Information security incidents for the topic addressed in the policy or procedure and the follow-up;
3. Performance of the internal controls regarding information security for the topic addressed in the policy or procedure; and
4. Planned changes for the topic addressed in the policy or procedure to address cybersecurity risks and information security and cybersecurity.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

No change.

**Additional criterion:**

Additional criterion newly included.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.